Read-only permissions still leave you open to resource exhaustion attacks.

On the write side, it's nice to have your query return structured data that can automatically update your client-side cache.